Read the docs
TI-2026-80576 Aliases CVE-2026-65629

Weak key derivation in jose password-protected key export

Priority HIGH 68CWE-916Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The jose library from 1.10.0 before 1.11.13 exports password-encrypted private keys using PBKDF2 with a fixed 2048 iterations and an 8-byte salt. These parameters are far below current guidance and callers cannot change them, which is an instance of insufficient computational effort for password hashing (CWE-916). An attacker who obtains an exported key blob, for example from a backup or configuration repository, can run an offline password guessing attack and recover the full private key.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a password-encrypted private-key export to recover the private key through an offline password-cracking attack. When jose exports a password-encrypted private key with jose_jwk:to_der/2 (JOSE.JWK.to_der/2), the jose_jwk_der:to_binary/3 function in src/jwk/jose_jwk_der.erl serializes the key as a PKCS#8 EncryptedPrivateKeyInfo using the PBES2 scheme with hardcoded key-derivation parameters: PBKDF2-HMAC-SHA256 with an iteration count of 2048 and an 8-byte (64-bit) random salt. Neither value can be overridden by the caller. Both values are far below current guidance (OWASP recommends on the order of 600,000 iterations for PBKDF2-HMAC-SHA256, and NIST recommends salts of at least 128 bits), so the key-stretching work factor is roughly 300 times lower than intended and the short salt reduces the cost of precomputation across keys. The symmetric encryption (AES-256-CBC with a 16-byte random IV) is not affected; the weakness is entirely in the derivation strength. An attacker who obtains one of these exported blobs (for example from a backup, configuration repository, object storage, or logs) can mount a cheap offline dictionary or brute-force attack against the export password, and success yields the full private key. This issue affects jose: from 1.10.0 before 1.11.13.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00062 0th percentileScored 2026-11-07
Fix Fixed jose (potatosalad): 1.11.13

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
potatosaladjose1.10.0 to before 1.11.131.11.13Patch availableCNA
  • jose Vendorpotatosalad Affected 1.10.0 to before 1.11.13 Fixed in 1.11.13 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:*——potatosalad
  • cpe:2.3:a:potatosalad:jose:*:*:*:*:*:*:*:* Versions — — ·potatosalad

Remediation

Update jose to version 1.11.13, the fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA jose (potatosalad) Fixed in 1.11.13

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    potatosalad jose 1.11.13

    8 records Highest priority Priority HIGH 1 HIGH, 5 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-80578 erlang-jose JWK parsing CPU exhaustion via attacker-chosen RSA modulusPriority MEDIUM 64
    • TI-2026-80574 Decompression bomb in potatosalad jose exhausts memory via JWE tokensPriority MEDIUM 64
    • TI-2026-80577 Timing side channel in pure-Erlang X25519 leaks private keys in josePriority MEDIUM 60
    Show all 8 records →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-65629
  2. 2026-10-27 Priority changed: MEDIUM → LOW
  3. 2026-11-02 CISA SSVC decision points changed
  4. 2026-11-02 Priority changed: LOW → HIGH
  5. 2026-11-06 Affected versions changed · Red Hat
  6. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Advisory 1

Other 3

  • TI-2026-80578 erlang-jose JWK parsing CPU exhaustion via attacker-chosen RSA modulus CVSS 4.0MEDIUM 6.9
  • TI-2026-80574 Decompression bomb in potatosalad jose exhausts memory via JWE tokens CVSS 4.0MEDIUM 6.9
  • TI-2026-80577 Timing side channel in pure-Erlang X25519 leaks private keys in jose CVSS 4.0MEDIUM 5.9
  • TI-2026-80575 Unbounded recursion in jose JWK shared secret derivation causes DoS CVSS 4.0MEDIUM 5.9
  • TI-2026-80579 ECDSA signature length is not validated in jose, allowing signature malleability CVSS 4.0MEDIUM 5.1
  • TI-2026-80573 Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose CVSS 4.0MEDIUM 5.9
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences